Disalow x-forwarded headers in CORS redirect

f3cfc4c3c9672451ca9ca877aef5aed6737a4f87

Cohee <18619528+Cohee1207@users.noreply.github.com>

server.js+8 -8 Viewed

         try {
             const headers = JSON.parse(JSON.stringify(req.headers));
 -            delete headers['x-csrf-token'];
 +            const headersToRemove = [
 -            delete headers['host'];
 +                'x-csrf-token', 'host', 'referer', 'origin', 'cookie',
 -            delete headers['referer'];
 +                'x-forwarded-for', 'x-forwarded-protocol', 'x-forwarded-proto',
 -            delete headers['origin'];
 +                'x-forwarded-host', 'x-real-ip', 'sec-fetch-mode',
 -            delete headers['cookie'];
 +                'sec-fetch-site', 'sec-fetch-dest',
 -            delete headers['sec-fetch-mode'];
 +            ];
 -            delete headers['sec-fetch-site'];
++
 -            delete headers['sec-fetch-dest'];
 +            headersToRemove.forEach(header => delete headers[header]);
             const bodyMethods = ['POST', 'PUT', 'PATCH'];